Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,537 detections
Filters
Last updated
All Time
Detection languages
3,970
998
598
428
233
Contributors
1,363
1,250
1,066
954
384
Categories
2,933
2,196
2,017
1,857
1,411
Platforms
39,936
7,266
6,537
3,866
3,647
Products / Services
4,107
2,418
1,587
270
254
MITRE Techniques
1,450
1,310
1,022
934
696
CVEs
46
46
33
18
12
IDS Classtypes
1,753
458
404
325
220
IDS Protocols
2,202
773
381
300
93
Detects DNS queries, HTTP host headers, and TLS SNI traffic associated with known credential-phishing domains used by the threat actor TA419. The rule monitors for communication to a specific list of domains identified as malicious or used in phishing campaigns.
Detects outbound HTTPS traffic to domains using file-sharing or cloud-sync themed keywords in combination with specific top-level domains (TLD) often associated with suspicious infrastructure. The rule specifically excludes well-known legitimate services such as OneDrive, SharePoint, Dropbox, Box, iCloud, and Google, and includes a detection threshold to minimize alerts for incidental traffic.
Detects outbound HTTPS traffic to domains using file-sharing or cloud-sync themed keywords in combination with specific top-level domains (TLD) often associated with suspicious infrastructure. The rule specifically excludes well-known legitimate services such as OneDrive, SharePoint, Dropbox, Box, iCloud, and Google, and includes a detection threshold to minimize alerts for incidental traffic.
This rule detects established TLS connections to external hosts that utilize a specific self-signed certificate associated with TA419 phishing infrastructure. The rule specifically flags connections presenting a TLS certificate with Subject and Issuer fields containing 'C=US, ST=Kansas, L=Millsstad, O=Castro Inc, CN=CI'.
This rule detects established TLS connections to external hosts that utilize a specific self-signed certificate associated with TA419 phishing infrastructure. The rule specifically flags connections presenting a TLS certificate with Subject and Issuer fields containing 'C=US, ST=Kansas, L=Millsstad, O=Castro Inc, CN=CI'.
This rule detects established TLS connections to external hosts that utilize a specific self-signed certificate associated with TA419 phishing infrastructure. The rule specifically flags connections presenting a TLS certificate with Subject and Issuer fields containing 'C=US, ST=Kansas, L=Millsstad, O=Castro Inc, CN=CI'.
This rule detects established TLS connections to external hosts that utilize a specific self-signed certificate associated with TA419 phishing infrastructure. The rule specifically flags connections presenting a TLS certificate with Subject and Issuer fields containing 'C=US, ST=Kansas, L=Millsstad, O=Castro Inc, CN=CI'.
This rule detects potentially compromised accounts by correlating risky Entra ID sign-ins to Citrix NetScaler with subsequent VPN session establishment followed by rapid, high-volume outbound connection activity from the source IP address. This pattern is indicative of a threat actor using compromised credentials to gain access via VPN and immediately perform internal network scanning or data staging.
Detects a suspicious sequence of events involving NetScaler ADC or Gateway appliances: anomalous account authentication, followed by the establishment of a VPN or remote access session, and subsequent unusual outbound network activity indicating potential lateral movement or C2 communication from the appliance.
Identifies NetScaler ADC or Gateway software versions in the inventory that are known to be vulnerable to CVE-2026-88771 and CVE-2026-88772, despite having received the patch for CVE-2026-19490.
This rule detects an exploitation attempt targeting a memory overflow vulnerability in Citrix NetScaler Gateway, specifically identifying oversized DTLS handshake length fields in UDP traffic. The rule triggers when a DTLS packet exceeds the specified size threshold, which is indicative of a buffer overflow attack intended to cause a service crash (Denial of Service).
This rule detects an exploitation attempt targeting a memory overflow vulnerability in Citrix NetScaler Gateway, specifically identifying oversized DTLS handshake length fields in UDP traffic. The rule triggers when a DTLS packet exceeds the specified size threshold, which is indicative of a buffer overflow attack intended to cause a service crash (Denial of Service).
This rule detects an exploitation attempt targeting a memory overflow vulnerability in Citrix NetScaler Gateway, specifically identifying oversized DTLS handshake length fields in UDP traffic. The rule triggers when a DTLS packet exceeds the specified size threshold, which is indicative of a buffer overflow attack intended to cause a service crash (Denial of Service).
Detects outbound HTTP requests or TLS traffic to known C2 domains associated with APT28/UAC-0001 related to the CVE-2026-21509 campaign.
This rule monitors network appliance logs (Fortinet, Cisco, Meraki, WatchGuard, Sophos) for patterns associated with known vulnerabilities, including authentication bypass (CVE-2022-40684), SQL injection, path traversal, and command injection attempts within URL parameters. It also flags high-severity IPS/IDS alerts generated by these devices.
Detects the creation of new administrator accounts or super_admin profiles on network devices such as firewalls from Fortinet, Cisco, Meraki, WatchGuard, and Sophos. This rule monitors log messages indicating administrative account provisioning, which is a potential indicator of unauthorized account manipulation or persistence attempts.
Detects bulk or frequent modifications to firewall policies across various network vendor devices, including Fortinet, Cisco Meraki, WatchGuard, and Sophos. The rule identifies high volumes of policy changes within a 15-minute window or logs summary counts to highlight potentially unauthorized administrative activity.
This rule detects potential brute force activity against network infrastructure devices (firewalls/UTMs). It identifies a sequence where a specific Source IP records multiple failed authentication attempts within a 1-hour window, followed by a successful authentication attempt from the same IP address. This pattern suggests a successful compromise of an account via credential guessing.
Detects anomalous NetScaler session activity potentially indicative of session hijacking or token forgery. This includes identifying session tokens reused across different source IP addresses or user-agents within a short timeframe, as well as detecting session tokens utilized in traffic without a preceding recorded authentication or logon event.
Detects incoming web server requests containing suspicious, URL-encoded SQL injection patterns indicative of automated probing or exploitation attempts, such as UNION SELECT, boolean-based injection fragments, and comment sequences.
Detects a single source IP initiating network connections to 50 or more distinct destination ports within a 60-second window, which is indicative of an automated port scanning sweep. The rule correlates individual connection events while excluding pre-defined allowlisted vulnerability scanners.
Page 19 of 312